The QR code points to someone else's server . That person could replace the legitimate boot.firm with a malicious one at any time. This could brick your console, steal data, or install ransomware. You are trusting an anonymous patcher blindly.
The modern replacement for the old method of installing homebrew via QR codes is . luma updater 26 qr code patched